From 062b516a0719871c759831f218fea623851751e4 Mon Sep 17 00:00:00 2001 From: Vignesh Viswanathan Date: Thu, 11 Oct 2018 17:18:41 +0530 Subject: [PATCH] qcacld-3.0: Hold VDEV ref count for SME command until freed Currently a ref count for VDEV is taken while posting the SME command to serialization in csr_set_serialization_params_to_cmd called from csr_queue_sme_command. However once the command is posted to serialization queue, the VDEV ref count is released which could lead to the VDEV object used from the serialization callback without holding the ref count. Release the VDEV ref count only if the posting to serialization module fails and for success cases, release the ref count from sme_ser_cmd_callback under the WLAN_SER_CB_RELEASE_MEM_CMD case. Change-Id: I8d573ff5a25e6dff928b2708e51ad7b97e292277 CRs-Fixed: 2331716 --- core/sme/src/common/sme_api.c | 3 +++ core/sme/src/csr/csr_api_roam.c | 7 ++++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/core/sme/src/common/sme_api.c b/core/sme/src/common/sme_api.c index 2296ceee636d..182f6e4978a4 100644 --- a/core/sme/src/common/sme_api.c +++ b/core/sme/src/common/sme_api.c @@ -573,6 +573,9 @@ QDF_STATUS sme_ser_cmd_callback(void *buf, break; case WLAN_SER_CB_RELEASE_MEM_CMD: sme_debug("WLAN_SER_CB_RELEASE_MEM_CMD callback"); + if (cmd->vdev) + wlan_objmgr_vdev_release_ref(cmd->vdev, + WLAN_LEGACY_SME_ID); sme_cmd = cmd->umac_cmd; csr_release_command_buffer(mac_ctx, sme_cmd); break; diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c index 01dff3074736..859108596421 100644 --- a/core/sme/src/csr/csr_api_roam.c +++ b/core/sme/src/csr/csr_api_roam.c @@ -20437,9 +20437,6 @@ QDF_STATUS csr_queue_sme_command(tpAniSirGlobal mac_ctx, tSmeCmd *sme_cmd, ser_cmd_status = wlan_serialization_request(&cmd); sme_debug("wlan_serialization_request status:%d", ser_cmd_status); - if (vdev) - wlan_objmgr_vdev_release_ref(vdev, WLAN_LEGACY_SME_ID); - switch (ser_cmd_status) { case WLAN_SER_CMD_PENDING: case WLAN_SER_CMD_ACTIVE: @@ -20460,7 +20457,11 @@ QDF_STATUS csr_queue_sme_command(tpAniSirGlobal mac_ctx, tSmeCmd *sme_cmd, return status; error: + if (vdev) + wlan_objmgr_vdev_release_ref(vdev, WLAN_LEGACY_SME_ID); + csr_release_command_buffer(mac_ctx, sme_cmd); + return QDF_STATUS_E_FAILURE; }